00. Exposing a Currently Active NSO Spyware Group's Domain Portfolio - An OSINT 
Analysis 


We've recently came across to an Amnesty International forensics research detailing the 
Internet and domain-connected infrastructure of several recent and historical widespread NSO 
Group spyware malware serving campaigns and we’ve decided to dig a little bit deeper into their 
connected Internet-connected infrastructure and offer practical and relevant actionable 
intelligence on the actual owners behind the infrastructure using WhoisXML API's vast and 
in-depth real-time and historical WHOIS data in combination with Maltego. 


In this article we'll take a look at and profile some of the NSO Group’s currently active 
Internet-connected infrastructure for the purpose of offering the security industry the necessary 
loCs including personally identifiable information which could grealy assist in current and 
ongoing cyber attack attribution campaigns. 
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Sample Screenshot of a well-known NSO Spyware affiliated Internet-connected 
infrastructure in action 


We've decided to grab a copy of several publicly accessible and publicly obtainable domain 
portfolios of NSO Group spyware domains and use WhoisXML API's vast and in-depth real-time 
and historical WHOIS database in combination with Maltego in an attempt to offer practical and 
relevant threat intelligence information on some of their current and ongoing campaigns. 


Sample well-known NSO Spyware Internet-connected domain infrastructure in particular 
well known domain registrant email addresses: 


angelodupre@outlook[.]Jes 
s-h@chorus[.Jocn[.]ne[.]jp 
nikdeapen@gmail[.Jcom 


lisovyy89@gmail[.]Jcom 
domain-hk@outlook[.]Jcom 
ceo@intellimath[.]com 
varela_george@corp[.]truxgo[.]Jcom 
baomat@dichvubaomattenmien[.]vn 
eran[.]benami0401@gmail[.Jcom 
jcdejesus609@gmaill[.Jcom 
Imatheo35@gmaill.Jcom 
lidorg@nsogroup[.]Jcom 
Lynn[.Jabelen@gmail[.]com 
JANETWINBLOE@GMAIL[.]COM 
info@my-anandaf[.]co[. Jil 
replay720@hanmail[.]net 
annettbohler@gmail[.]Jcom 
Ahmed[.]Almansoori1982@outlook[.Jcom 
info@chinacapitall[.]com 
gulstad1@gmail[.]com 
IT@nsogroup[.]com 
maxlindholm68@gmail[.]Jcom 
carlydewitte@outlook[.]com 
kelly[.]stephens@utoronto[.]ca 
anshul@z[.]biz 
rbolle68@gmaill.Jcom 
domain-hk@outlook[.]Jcom 
elvinymannn@gmail[.Jcom 


Sample NSO Group spyware domains known to have been or are currently participating 
in various currently active malware and spyware serving campaigns: 


alljazeera[.Jco 
bbc-africa[.Jcom 
cnn-africa[.]co 
unonoticias[.]net 
univision[.]click 
track-your-fedex-package[.]Jorg 
mz-vodacon|. ]info 
iusacell-movil[.]com[.]mx 
sabafon[.]info 
newtarrifs[.]net 
yOutube[.]com[.]mx 
fb-accounts[.]com 
googleplay-store[.]Jcom 
whatsapp-app[.]com 
accounts[.]mx 


adjust-local-settings[.]Jcom 
emiratesfoundation[.]net 
topcontactco[.]com 
icrcworld[.]Jcom 
redcrossworld[.]Jcom 
checkinonlinehere[.]com 
turkishairines[.]info 
bulbazaur[.]Jcom 
pickuchu[.]Jcom 
aalaan[.]tv 
accounts[.]mx 
alawaeltech[.Jcom 
alljazeera[.Jco 
asrararabiyal[.]co 
asrararablya[.]Jcom 
asrarrarabiya[.]Jcom 
bahrainsms[.]co 
bbc-africa[.Jcom 
bulbazaur[.]Jcom 
checkinonlinehere[.]com 
cnn-africa[.]co 
damanhealth[. online 
emiratesfoundation[.]net 
fb-accounts[.]com 
googleplay-store[.Jcom 
icloudcacher[.]com 
icrcworld[.]Jcom 
manoraonline[.]net 
mz-vodacon|.]info 
newtarrifs[.]net 
ooredoodeals[.]Jcom 
pickuchu[.]Jcom 
redcrossworld[.]com 
sabafon[.]info 
smser[.]net 
sms[.]webadv[.]co 
topcontactco[.]com 
turkeynewsupdates[.]Jcom 
turkishairines[.]info 
uaenews[.Jonline 
univision[.]click 
unonoticias[.]net 
whatsapp-app[.]com 
yOutube[.]com[.]mx 


14-tracking[.]Jcom 
akhbar-arabia[.]Jcom 
animal-politico[.Jcom 
nomorewarnow[.]com 
noticiaspoliticos[.]Jcom 
nouveau-president[.]Jcom 
politicalpress[.Jorg 
politicoportales[.Jorg 
politiques-infos[.]info 
revolution-news[.]co 
shia-voice[.]com 
signpetition[.]co 
social-life[.Jinfo 
unOnoticias[.]Jcom 
unOnoticias[.]net 
universopolitico[.]net 
adjust-local-settings[.Jco 
afternicweb[.]net 
arabnews365][.]com 
banca-movil[.Jcom 
ecommerce-ads[.]org 
kingdom-deals[.]com 
nsoga[.Jcom 
pine-sales[.Jcom 
qaintqa[.]Jcom 
remove-subscription[.]co 
track-your-fedex-package[.]Jonline 
ideas-telcel[.]com[.]mx 
mymensaje-sms[.]Jcom 
network190[.]com 
secure-access10[.]mx 
smscentro[.]com 
twiitter[.]com[.]mx 
all-sales[.]info 
arabworld[.]biz 
beststores4u[.]com 
cheapapartmentsaroundme[.]com 
daily-sport[.]Jnews 
dinneraroundyou[.]com 
findmyplants[.]Jcom 
housesfurniture[.Jcom 
kingdom-news[.]com 
mideast-today[.]Jcom 
muslim-world[.]info 


news-gazette[.]info 

# nouvelles247[.]com 
promosdereve[.]com 
sunday-deals[.]Jcom 
wonderfulinsights[.]com 
banca-movill.Jnet 
savephotos[.]net 
onlineshopzm[.]com 
zednewszm[.]Jcom 
zm-banks[.]Jcom 
zm-weather[.]com 
nothernkivu[.]com 
afriquenouvelle[.Jcom 
allafricaninfo[.]com 
centrasia-news[.]com 
mystulchik[.Jcom 
odnoklass-profile[.]com 
sputnik-newsJ[.]info 
tengrinews[.]co 
sergek[.]Jinfo 
egov-sergek[.]info 
mykaspil[.]com 
kaspi-payment[.]com 
e-sveiciens[.]com 
klientuserviss[.]Jcom 
kurjerserviss[.]Jcom 
reklamas[.]info 
legyelvodas[.]com 
theastafrican[.]Jcom 
ajelnews[.]net 
akhbara-aalawsat[.]com 
centrasia-news[.]com 
tengrinews[.]co 
akhbar-arabia[.]Jcom 
gulf-news[.]info 
eltiempo-news[.]com 
sputnik-newsJ[.]info 
arabnews365][.]com 
arabworldnews[.]info 
breaking-extranews[.Jonline 
breaking-news[.]co 
breakingnewsasia[.]Jcom 
breakthenews[.]net 
daily-sport[.]Jnews 


diaspora-news[.]com 
discoveredworld-news[.]com 
eurosportnews|.]info 
golf-news[. Jlive 
investigationews[.]com 
islamic-news-today[.]com 
kingdom-news[.]com 
leadersnews[.]org 
news-alert[. Jorg 
news-gazette[.]info 
newscurrent[.]info 
newsdirect[.Jonline 
newsofficiall. info 
newsofthemoment{[.]net 
newworld-news[.]Jcom 
online-dailynews[.]Jcom 
only-news[.]net 
operatingnews[.]Jcom 
posta[.]Jnews 
regionews[.]net 
topten-news[.]info 
zednewszm[.]Jcom 
business-today[.]info 
hmizat[.]co 
infospress[.]Jcom 
revolution-news[.]co 
stopsms[.]biz 
videosdownload[.]co 
chretiendaujoudhuil[.]Jcom 
viedechretien[.Jorg 
vie-en-islam[.]com 
leprotestant[.Jcom 
regularhours{[.]net 
bananakick[.]net 
crashparadox[.]net 
flowersarrows[.]com 
holdmydoor[.]Jcom 
stilloak[.]net 
accountant-audio[.]Jcom 
audienceflake[.]Jcom 
secureyouradd[.]com 
smallperfumerain[.]com 
takemallelectric[.]Jcom 
weddingbandsoft[.]com 


syncingprocess[.]Jcom 
syncingprocess[.]Jcom 
sweet-water[.Jorg 
permalinking[.Jcom 
gettingurl[.]Jcom 
quota-reader[.]net 
redirigir[.]net 
towebsite[.]net 
prioritytrail[.]net 
todoinfonet[.]Jcom 
beanbounce[.]net 
alignmentdisabled[.]net 
reloadinput[.]Jcom 
gettingurl[.]Jcom 
netvisualizer[.Jcom 
buildyourdata[.]com 
preferenceviews[.]Jcom 
myfundsdns[.]com 
urlpush[.]net 
transferlights[.]Jcom 
baramije[.]net 
free247downloads[.]com 
transferlights[.Jcom 
documentpro[.Jorg 
domain-routing[.]com 
towebsite[.]net 
stopsms[.]biz 
manydnsnow[.]com 
dns-analytics[.]Jcom 
infospress[.]Jcom 
opera-van[.]com 
revolution-news[.]co 
netvisualizer[.Jcom 
infospress[.]Jcom 
reception-desk[.]net 
hmizatl[.]co 
videosdownload[.]co 
handcraftedformat[.]Jcom 


Related NSO Group spyware domains known to have been involved in various and 
currently active malware and spyware serving campaigns: 


qoros5].]website 
goros3J.]website 


document-pdf[.]net 
network190[.]Jcom 
urphotostorage[.]net 
juicyladies[.]net 
telefoniaya[.Jcom 
buyvpsserver[.]Jcom 
rentvpsserver[.]Jcom 
bestday-sales[.]Jcom 
rentdedicatedservers[.]Jcom 
diarioelhacker[.]Jcom 
xi-jinping[.]biz 
noticierokawaii[.]Jcom 
xi-jingping[.]info 
diariohablando[.]com 
googleplay-store[.Jcom 
noticiasxhoy[.]Jcom 
internetdigital[.]net 
goros5].]biz 
allservernews[.]com 
goros3J.]biz 
unlimitedpicture[.]Jcom 
xi-jinping[.Jorg 
endtwoend[.]us 
yourxnews[.]com 
xi-jinping[.]info 

goros5. info 

goros3J. info 
fulldedicatedserver[.]com 
qoros3[.Jorg 
qoros5[.Jorg 
zurucu[.]cn 

ec2x[.Jcn 
bulbazaur[.]Jcom 
vjv219[.Jon 
bj8i9[.]Jcom[.Jcn 
bcO0y2[.]com[.]Jcn 
vpcoevid[.]cn 
pickuchu[.]Jcom 
glzkbt42[.Jcn 
dressesforwomanblog[.]com 
staticheap|[.Jorg 
staticheap[.]info 
tropicalfishaquariums[.]net 
urbanclothingz[.]net 


womensswimware[.]net 
webhostingplansz[.]net 
womensclothingg[.]net 
travelplannner[.]net 
webhostingplanz[.]net 
bc3y8[.]com[.Jcn 
vietnamhotell[.]net 
websearchsitez[.]net 
weddingplannin[.]net 
bd9n7[.]com[.Jcn 
bI7g5[.Jcn 
bn2w6[.]com[.Jcn 
wwwphim8g[.]net 
aobj[.]Jcom[.]cn 
wmgreatjobs[.]net 
remove-subscription[.]com 
remove-from-mailinglist[.]Jcom 
updatedchargers[.]com 
naderproductions[.]desi 
lali[.Jdesi 
dhirproductions[.]desi 
dalla[.]Jdesi 

banger[.]desi 
gurunanaksweets[.]desi 
airconditioner[.]desi 
swagsada[.]desi 
beurer[.]desi 

gashti[.]desi 

gymboy[.]desi 
add-client[.Jcom 
remove-client[.]com 
track-your-fedex-package[.]com 
wallpaperwell[.Jcom 
luckybrush[.]net 
newmexicoinjuryclaimscenter[.]Jcom 
thewalkingdeadseason6episodes[.]Jcom 
teknoloji7[.Jcom 
domain2[.]net 
usfusionsupply[.]Jcom 
rustystackshop[.]com 
wwwsecurecreditor[.]Jcom 
thienduongquangcaoJ.]net 
ixbux[.Jcom 
diyetisyenim[.]com 


aryaveer[.]desi 
mdclead[.]Jorg 
univision[.]click 


Related NSO Group spyware and malware domains known to have been involved and are 
currently used in various malware and spyware serving campaigns: 


hophipearly[.]Jcom 
titanequipment[.Jcom 
elpsotimes[.]com 
fenda[.]Jcom 
thientho[.]com 
dailrecord[.]Jcom 
wattrick[.]Jcom 
dobbinshouse[.]com 
vietnamdeli[.]Jcom 
chearcaribbean[.]Jcom 
dynaflip[.Jcom 
doerfurniture[.Jcom 
educalogy[.Jcom 
hydpolice[.Jcom 
collegexp[.]Jcom 
wwwhairsister[.]com 
qaoffers[.]net 
ooredoodeals|.]Jcom 
bestday-sales[.]Jcom 
qoros5].]website 
banca-movill.Jcom 
ex-pressen[.]com 
fb-accounts[.]com 
fakenewssweden|.]bid 
googleplay-store[.]Jcom 
fakenewssweden[.]link 
whatsapp-app[.]com 
sputnik-news[.]net 
clubmovistar[.]com 
sputnik-news[.Jorg 
mlearningcenter[.]Jcom 
sweetplacebakery[.]Jcom 
mwlan[.Jcom 
bigtenwork[.]Jcom 
vietdeli[.]net 
immath[.Jcom 
vienthuc[.]Jcom 


mlearningservices[.]com 
rihannaf[.]biz 
blagoevgrad[.]biz 
gonavstudio[.]com 
dotson[.]biz 

smilies[.]biz 
designers[.]biz 
highend[.]biz 
mcxoperators[.]Jcom 
nsoga[.Jcom 

tbilisi[.]biz 
nsogroupf.]co[.]il 
homeloans[.]biz 
werkstoffeigenschaften[.]com 
aobj[.]Jcom[.]cn 
bd9n7[.]com[.Jcn 
bc3y8[.]com[.]cn 
bn2w6[.]com[.Jcn 
bj8i9[.]Jcom[.Jcn 
zurucu[.]cn 

bI7g5[.Jcn 

vjv219[.Jon 

glzkbt42[.Jcn 
bcOy2[.]com[.Jcn 
ec2x[.Jcn 

vpcoevid[.]cn 

192[.]biz 

fiction[.]biz 
csi-degrees[.]net 
usfusionsupply[.]Jcom 
luckybrush[.]net 
domain2[.]net 
thienduongquangcao.]net 
ixbux[.Jcom 
thewalkingdeadseason6episodes[.]Jcom 
teknoloji7[.Jcom 
wwwsecurecreditor[.]Jcom 
diyetisyenim[.]com 
realfatburner[.]Jcom 
rustystackshop[.]com 
sms-zone[.]Jorg 
whatsappsupport[.]net 
bahrainsms[.]co 
qatarlife[.Jco 


szaldin[.]Jcom 
endtwoend[.]us 
endtwoend[.]com 
qaintqa[.]Jcom 

smser[.]net 

labtop[.]co[.]il 
crashparadox[.]net 
network190[.]Jcom 
track-your-fedex-package[.]com 
updatedchargers[.]com 
blogupdatednews[.]com 
bytlo[.]Jcom 
pine-sales[.]Jcom 
mymensaje-sms[.]Jcom 
dressesforwomanblog[.]com 
ticket-selections[.]com 
reception-desk[.]com[.Jua 
unonoticias[.]net 
reception-desk[.]net 
bananakick[.]net 
wonderfulinsights[.]com 
diariohablando[.]com 
novedadesunicas[.]com 
noticiasxhoy[.]Jcom 
recibeinformacion[.]Jcom 
rentvpsserver[.Jcom 
noticiasyhumoradiario[.]com 
unlimitedpicture[.]Jcom 
consejosadiario[.]com 
globalpromomarket[.]com 
elrinconinformativo[.]Jcom 
diarioelhacker[.]Jcom 
todoinfonet[.]Jcom 
noticierokawaii[.]Jcom 
compartiendoestilos[.]com 
allservernews[.]com 
fulldedicatedserver[.]com 
yourxnews[.]com 
losmasviralesdelared[.]Jcom 
internetdigital[.Jnet 
tipsymuchomas[.]com 
sorasystems[.]com 
donald-trump[.]biz 
donaldtrump[.]gratis 


sputnik-newsJ[.]info 
donald-trumpf[.]club 
univision[.]click 
sputnik-news[.]biz 
sputnik-news[.]link 
bulbazaur[.]Jcom 
pickuchu[.]Jcom 
secure-access10[.]com 
adjust-local-settings[.]Jcom 
urphotostorage[.]net 
remove-from-mailinglist[.Jcom 
document-pdf[.]net 
remove-subscription[.]com 
googleadsnetwork[.]com 
add-client[.Jcom 
outbraintraffic[.Jcom 
remove-client[.]com 
urlshortening[.]net 
juicyladies[.]net 
thictionary[.]Jcom 
cruisez[.]Jcom 
hostlot[.]Jcom 
noticiasalive[.Jnews 
projectsy[.Jcom 
totaljobs[.]work 
databasis[.]com 
tododeporte[.Jonline 
placeslike[.Jcom 
eventtos[. ]live 
backlinked[.]Jcom 
telefoniaya[.Jcom 
stayings[.]Jcom 
fotoface[.]net 
politicoportales[.Jorg 
urlshortening[.]Jcom 
thebestseller[.]info 
priceworthy[.]com 
socialredes[.]com 
findmydeals[.Jinfo 
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politicalpress.org 


kelly.stephens@utoronto.ca 


Sample IPs known to have been involved in various NSO Group spyware and malware 
serving campaigns: 


69.175.18.85 
99.83.154.118 
209.126.124.66 
162.255.119.246 
192.64.119.28 
162.255.119.199 
72.14.185.43 
45.33.20.235 
96.126.123.244 
45.56.79.23 
173.255.194.134 
95.216.161.60 
45.33.30.197 
159.69.83.207 
45.33.18.44 


159.69.186.9 
72.14.178.174 
159.69.42.212 
192.64.119.75 
34.196.164.216 
109.234.109.84 
52.203.208.133 
109.234.109.85 
185.38.151.11 
37.48.65.152 
151.106.5.172 
192.155.108.151 
151.106.5.168 
207 .244.67.214 
37.48.65.155 
151.106.5.164 
198.54.117.200 
198.54.117.199 
23.20.239.12 
198.54.117.198 
192.155.108.150 
198.54.117.197 
207 .244.67.218 
162.255.119.162 
162.255.119.219 
162.255.119.254 
192.64.119.74 
162.255.119.222 
3.137.40.228 
198.58.118.167 
52.128.23.153 
162.255.119.86 
184.168.221.59 
50.63.202.61 
192.64.119.108 
184.168.221.58 
50.63.202.54 
192.64.119.71 
50.63.202.57 
50.63.202.37 
162.255.119.133 
69.64.147.10 
75.2.37.224 
162.255.119.248 


3.135.32.112 
13.59.183.11 
45.33.23.183 
185.53.177.20 
208.91.197.91 
91.195.240.87 
209.99.40.222 
91.195.240.89 
68.66.248.32 
3.223.115.185 
209.99.40.223 
18.211.9.206 
45.79.19.196 
45.33.2.79 
184.168.221.54 
184.168.221.47 
184.168.221.45 
50.63.202.47 
159.69.44.32 
78.47.89.88 
50.63.202.48 
159.69.118.33 
34.102.136.180 


Sample malicious and rogue MD5s known to have participated in various NSO Group 
spyware and malware serving campaigns: 


dd2fa9e6b337ecbf746b58a4b346dbc6d46f6f70cd8e1d7b089be72438def365 
53db921325a766bcdb4b21fe1 8bc4c6 1cc2ff33238c2414075f64e01 7810c4b0 
fa420768778e1 7bcb6b0fdab25564b 11fa14c5a9a74e0e49756e407281648f22 
259179a23531087391e464644fdc2e5deb5437bf96 73acaeaf9a2dedfaccf0b3 
855340d0e6325c1811fd218f0e1 f73cfdfb24baad5cde152b802d6101b12d31ae 
717e7ad5b1308a3eb33df7b727e1b2cf465fcb0d1 7fdef7 7fb8815335c443cb7 
77d2a4edf82227546b49c46a770afcd47cc386a1a4b170ed0c3bf6 7ddba5988b 
d978d5d02236be8b962707b3a21fc93fb003d332e6c0d26a766b3ed65b976f3F 
2e7c4efda27ec6489216a0373f219eed8fced8cd8a5532d236026503c8c433ac 
6827db6327af344e656c059a32ac51d303c464e2eea2e6ddd55efbcbd3ed0271 
A4f17acd56293a5b4 7f34607da0a72b5a861 866fc888f5e2 154f46093aa04 133d 
aafa9855203c8d0911bc94a8f2c1 3ee5ae09fac62988f860a909329ed5fe091 7 
632aaeOdb6cfaG6f91f51199f067b1e1f2982de49d2 16d6ad8c3c8181632d9cb0 
ed03bdfcfb1db61ce20cf980a0c23b13595b23d8655985d876d86e3357bdfefc 
Oc39cafe8cce7 930b609baf142b46019b10a1e8bc1 7c803a823fb3ccffd5195e 
16b1128e1b68b3be2db7ba88f6dabd10823bbd55c9a4.a0da3 1O0ef06f1117d3c5 
47cc62ea1392315341343a8f37ad1b36294ed5163de228848cc2037791 7eabf0 


3cdaaQ9e60fd2 1c3409849bbff1 df108b8877b5b46fbd692016e51d19486d20b8 
2cc002d8811a554b1c39b1a0b9ba1e32d42c53610e77525c035e2fbccebf0bed 
65c70268398c5a01bed0ce6 1da8d76aaach83fcb24f52d0ab43a5c83725e35b4 
cb2445b8ba7d9ab4fc4444d26837 75ae297a11a451f7e5da2f4f1ae187fc32a2 
73401 b93baaf5823cd8bed95e40ea0f5e07 d0f91 5543c1d850c338cdd2524a01 
8b1a7e66432bd16b628ee0242453454370ad4a1ae03695249b59c11bc8561747 
Ofa1 8efe5c4487d25b1723e33bc/72f0bd86d6 2dff4 9fa7 3cdb20f040ddda03d6 
8fc8427adc52807 2faec320fd64f0366f1b1b4a2d84fb758d65b8ac35bc6030f 
2aa44473944c9cbba324b8b510da21e17968db6343e5221931b6715e58f2f95b 
4d44725793bf0f6b92c8b361c07 7bcaed5c649b6b51 9e21d9299bba4eb7902849 
375b52'63b738b20d1572fe 15605d48bdf1 564 113a9f995a67c1a3404011b503 
8088366390c09bf3558d53c4ee56033274e433a988bi9a46F784cfd7 8be63895 
1b9f33d978590c56 15aa5c51eda80f222a83a5c5a26e534d65e840b551 aff409 
6e450b2a50ce67fdd592270685454 72c6028 1fc740d281b8492cb894a6576aad 
639e5234a26 1 5ef52c764cef6f08b0ace9a7 0fbd9e 122e561 96dac635b0e56ad 
120c9bc6c5dc7 194f0330e68af35844fb366b9f5dbdc6e3cb01c6151c092ac45 
7¢62644de40c908ef7958d 1042e85dc8cb1 988cf224c6b01 8f21 2bfc5e7 75bb8d 
0c5b188463bc191e47b0d682758e5073f531 70beaeb23e5ch5dabbe232aeb4332 
0e01b5d30ff5e03273854664698cff42357fb029d5ce91 2af296 12a0495b54a9 
10e3083736fe2ccbb7553c07210b8fca88bbbd0dd7b1f607 1f2d385a5ceec252 
bc6fbbdb5def8fb43485282cb1 7bf244fcb 1fa46f5bcbcf8ce99aa1a3d6e5fc6 
646ccc3ee8 784741 bf22f5a47ba267a61 ad5b989d7a02fd7af3bc093ab5ba3347 
00042d23a72a99a3a883dfea20d94abd42a4397d18c31de627e1a5b0ced05395 
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c4ba1b0a39607eabda7 025858 75886F1c00d7925d9ff56c4c831 7679f4ad35d9 
£47fa666937b23c28dde7b80948522dca1 e6ad6cf9ced7d2d7cc75970fdb0c87 
Oe9c3dafad439a5417f0fa273eb2084ca04fdfd1cedbca4dbaa16a472646985e 
d3b9cd57249738d9ddf4ca77f4e009e3d60ebd08259bb3c91e5163bc66b4cac8 
7a/dc635e4 9f786d448acf4cabf4a1 809d2670c3cc30f3cdbe7f8452b49cb4bc 
b89da855f1efde9214109453bbf273969b436 1 bcfaa8a9e4.5592f23874 1ad1f6 
e82e9c71a2ab10c19dfb1abe307ddci64a334d8ad463e46989ebe5eb8824d5f2 
543ba932167b9d306f8f5d0fed5befd2f6a6 730b68e52ff4948e0dcdb2971ed9a 
42c9aa7a8d93e7fb6 1b0090b 1c4a2c2960c27 9eba8707f3b6baed04b0c5727b6 
30fc9e3c96dd509daef0d87 3661 72ffbd0d3b1a7843a1 57bbecc243e2faf5de7 
e80f6be51¢205351 9c59d8f4d40c5908ada0dfbf74becd6089f3637514c3882F 
bcfbc1420fe1552e32a172dde1d274bd2ba0f3af857c682f4a44d8667ad049b8 
7a498b98c89097 6c8b3e4 1 264b6457 1e5c3d70c89633d140a824cab5b29443bb 
630cc8fbf2a0510074c61c329f5e5e69e74e 1 af59e7207 7d8e093c98e21f3754 
4620a89cd8c2345bcb2a9cba7e8a0267f1 4639567683e75defbf14bb5396544f 
37e5cb0214e128b7c5b89ed3388fa7 e25cbfb1de90683fec42e2 19e204c02829 


a975214d240d5a033bef864d482e7636de68c48d5e94434833289b7e56962bb2 
ead5f5a7f40e1a30b6057a7537c43a547 9bf53c2afd1a35946e130597 9dd7cbbf 
db69228157003f214deb43278daa14d75f53f4e37b9cc9aff23F768af359af93 
a4728a1791a1c2b28b1590b34b0576a29a51 987bcbc56233d59e38d908d25b6d 
9a22754cd9d9be3d86637654c06b8bd3d8951 bcdd82a6c9581 843c1422de3a07 
938de314a8e1a32b6a85ab 1ce59f4f53f1 f9044d947df46dc16c6309cf048d80 
3a0f133eaf856be06a28bc9c5155b4a747e9ccO05dd0ce0373ac2353227cd354d 
0b307a3078822915c520b9c47541 79c491 08ae63efb556bedf5b1ac08904f5b2 
60f65d1d2b607f2031 49cdfb7efa9d2 1358ef0bc0d52306948f85098f7 bdfe8e 
d8899b628781bb902e2979ab3127d6e7fbbd5f024395882a0c9111a6ce919b55 
9b12612b728f89683ad0b1ab1a6402c6b3dd01ece25b1f9c323e0f5714c854de 
e8e01305aed42f5 1 8aeec6abf55268c7ab48807e37 1e189f3a4b 7af3d206e060 
a59f73e3b5de866720b545e8d855b5fef0b58d9 722c6a2c83f5b292ca85/76a51 


We'll continue monitoring the Internet-connected infrastructure of NSO Group for the purpose of 
monitoring and detecting relevant and related malware and spyware serving campaigns that are 
currently in the wild. 


